Commit d69e0779 authored by Jens Axboe's avatar Jens Axboe
Browse files

net: disallow ancillary data for __sys_{send,recv}msg_file() 



Only io_uring uses (and added) these, and we want to disallow the
use of sendmsg/recvmsg for anything but regular data transfers.
Use the newly added prep helper to split the msghdr copy out from
the core function, to check for msg_control and msg_controllen
settings. If either is set, we return -EINVAL.

Acked-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent 4257c8ca

net/socket.c

+37 −6
Original line number Diff line number Diff line
@@ -2389,12 +2389,27 @@ static int ___sys_sendmsg(struct socket *sock, struct user_msghdr __user *msg, 
/*

 *	BSD sendmsg interface

 */

long __sys_sendmsg_sock(struct socket *sock, struct user_msghdr __user *msg,

long __sys_sendmsg_sock(struct socket *sock, struct user_msghdr __user *umsg,

			unsigned int flags)

{

	struct msghdr msg_sys;

	struct iovec iovstack[UIO_FASTIOV], *iov = iovstack;

	struct sockaddr_storage address;

	struct msghdr msg = { .msg_name = &address };

	ssize_t err;



	err = sendmsg_copy_msghdr(&msg, umsg, flags, &iov);

	if (err)

		return err;

	/* disallow ancillary data requests from this path */

	if (msg.msg_control || msg.msg_controllen) {

		err = -EINVAL;

		goto out;

	}



	return ___sys_sendmsg(sock, msg, &msg_sys, flags, NULL, 0);

	err = ____sys_sendmsg(sock, &msg, flags, NULL, 0);

out:

	kfree(iov);

	return err;

}



long __sys_sendmsg(int fd, struct user_msghdr __user *msg, unsigned int flags,
@@ -2593,12 +2608,28 @@ static int ___sys_recvmsg(struct socket *sock, struct user_msghdr __user *msg, 
 *	BSD recvmsg interface

 */



long __sys_recvmsg_sock(struct socket *sock, struct user_msghdr __user *msg,

long __sys_recvmsg_sock(struct socket *sock, struct user_msghdr __user *umsg,

			unsigned int flags)

{

	struct msghdr msg_sys;

	struct iovec iovstack[UIO_FASTIOV], *iov = iovstack;

	struct sockaddr_storage address;

	struct msghdr msg = { .msg_name = &address };

	struct sockaddr __user *uaddr;

	ssize_t err;



	return ___sys_recvmsg(sock, msg, &msg_sys, flags, 0);

	err = recvmsg_copy_msghdr(&msg, umsg, flags, &uaddr, &iov);

	if (err)

		return err;

	/* disallow ancillary data requests from this path */

	if (msg.msg_control || msg.msg_controllen) {

		err = -EINVAL;

		goto out;

	}



	err = ____sys_recvmsg(sock, &msg, umsg, uaddr, flags, 0);

out:

	kfree(iov);

	return err;

}



long __sys_recvmsg(int fd, struct user_msghdr __user *msg, unsigned int flags,

CRA Git | Maintained and supported by SUSTech CRA and CCSE